Privacy Policy

We collect the following categories of personal data, depending on how you interact with the platform:

• Identification data: name, email address, phone number (optional), city.
• Account data: username, password (stored encrypted), notification preferences.
• Transaction data: history of requests, offers and sales, ratings and reviews.
• Usage data: pages visited, search terms, product interactions, time spent on the platform.
• Technical data: IP address, browser type, operating system, language settings, screen resolution.
• Cookies and similar technologies: as described in the dedicated cookie section.

We do not collect sensitive data (race, religion, sexual orientation, medical data, biometric data) and do not actively request such information.

We collect data in the following ways:

• Provided directly by you: when you create an account, publish a request or listing, submit an offer, complete a form, or contact us.
• Automatically: through cookies and other tracking technologies when you browse the platform.
• From third parties: if you use external authentication methods (Google, Facebook), we receive the basic information you choose to share.

We process your personal data for the following purposes:

• Service provision: creating and managing your account, publishing listings and requests, processing offers.
• Communication: notifications related to offers, messages between buyers and sellers, platform updates.
• Platform improvement: analyzing usage patterns to optimize the experience, develop new features, and improve the interface.
• Security: fraud prevention, account protection, ensuring transaction integrity.
• Marketing (with consent): sending personalized offers, recommendations, and newsletters, if you have opted in.
• Legal compliance: fulfilling legal and fiscal obligations, responding to authority requests.

We process your personal data based on the following legal grounds, in accordance with GDPR:

• Performance of a contract (Art. 6(1)(b)): to provide you with the platform services — account creation, listing publication, transaction management.
• Consent (Art. 6(1)(a)): for non-essential cookies, direct marketing, and promotional communications.
• Legitimate interest (Art. 6(1)(f)): for improving services, securing the platform, preventing fraud.
• Legal obligation (Art. 6(1)(c)): for maintaining fiscal records and compliance with legal regulations.

Your data is stored on secured servers within the European Union. We implement appropriate technical and organizational measures to protect data against unauthorized access, loss, alteration, or disclosure:

• SSL/TLS encryption for all data transmissions.
• Encrypted password storage (hash + salt).
• Role-based access control with limited permissions.
• Periodic security audits and security updates.
• Regular database backups.

We retain your data for as long as you have an active account on the platform. After account deletion, we retain data strictly required for legal obligations (e.g., fiscal records) for a period of 5 years, in accordance with Romanian legislation.

We do not sell your personal data to third parties. We may share data only in the following circumstances:

• Service providers: payment processors (Stripe, PayPal), delivery services (Sameday, Fan Courier), hosting and infrastructure services (AWS, Vercel), analytics services (Plausible, umami) — all with GDPR-compliant contracts.
• Legal authorities: when we are required by law or by a valid request from a competent authority.
• Other users: information you choose to make public (name, city, ratings) is visible to other platform users.

All our partners are contractually obligated to comply with GDPR and to process data only for the purposes specified by us.

As a data subject, you have the following rights under Regulation (EU) 2016/679:

To exercise any of these rights, send an email to gdpr@bumbyboom.ro. We will respond within 30 days, as required by law.

You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) — www.dataprotection.ro.

We use cookies and similar technologies to improve platform functionality, analyze traffic, and provide a personalized experience.

What are cookies?

Cookies are small text files stored on your device by your browser when you visit a website. They allow the website to recognize your device and remember your preferences.

Types of cookies used

How to manage cookies

You can control and manage cookies from your browser settings. You can also use our cookie banner to choose which types of cookies to accept. Please note that blocking essential cookies may affect the proper functioning of the platform.

Your data is stored and processed within the European Union. If we transfer data to third countries (outside the EEA), we ensure adequate safeguards are in place, such as:

• Standard contractual clauses adopted by the European Commission.
• Adequacy decisions by the European Commission for the respective country.
• GDPR-compliant contractual agreements with our partners.

We may update this policy periodically. We will notify you of significant changes by email or through an announcement on the platform. The date of the last update is displayed at the top of the page.

We encourage you to periodically review this page to stay informed about how we protect your data.

For questions about this privacy policy or to exercise your GDPR rights, you can contact us:

You can also contact the National Supervisory Authority for Personal Data Processing (ANSPDCP): www.dataprotection.ro, 28-30 G-ral. Gheorghe Magheru Blvd., Sector 1, Bucharest.